WAFFle: Fingerprinting Filter Rules of Web Application Firewalls

Size: px

Start display at page:

Download "WAFFle: Fingerprinting Filter Rules of Web Application Firewalls"

Alexina Ford
10 years ago
Views:

1 WAFFle: Fingerprinting Filter Rules of Web Application Firewalls Isabell Schmitt, Sebastian Schinzel* Friedrich-Alexander Universität Erlangen-Nürnberg Lehrstuhl für Informatik 1 IT-Sicherheitsinfrastrukturen

2 Talk presented at 6th USENIX Workshop on Offensive Technologies (WOOT 2012) Full paper: Full video of talk: 2

de/_download/woot12.pdf Full video of talk: https://www.usenix.

3 Introduction: Web Application Firewalls Web Application Firewalls intercept web requests filter requests to prevent attacks Internet Demilitarized Zone Intranet Web Server uses filter rules for detecting common attack patterns Passed Request Blocked Request blind for new attack patterns 3

Demilitarized Zone Intranet Web Server uses filter rules for detecting

4 Introduction: Web Application Firewalls Web Application Firewalls intercept web requests filter requests to prevent attacks Internet Demilitarized Zone Intranet Web Server uses filter rules for detecting common attack patterns Passed Request Blocked Request blind for new attack patterns If attacker knows active filter rule set, he can search for loopholes in the rule set What can the attacker learn about the active filter rule set of a WAF? 3

patterns Passed Request Blocked Request blind for new attack patterns If attacker knows active filter rule set,

5 WAFfle: Fingerprinting Filter Rules of Web Application Firewalls Idea behind WAFfle 1. Generate polymorphic representations of exploit code (e.g. <script>alert(23);</script>, <script_>alert(23);</script>, <script >alert(23);</script> <script >alert(23);</script>) 2. Send to web app and measure response time 3. Analyse response time Internet Passed Request Blocked Request Demilitarized Zone Intranet Web Server 4

<script>alert(23);</script>, <script_>alert(23);</script>, <script >alert(23);</script> <script

6 WAFfle: Fingerprinting Filter Rules of Web Application Firewalls Idea behind WAFfle Demilitarized Zone Intranet Web Server 1. Generate polymorphic representations of exploit code (e.g. <script>alert(23);</script>, <script_>alert(23);</script>, <script >alert(23);</script> <script >alert(23);</script>) 2. Send to web app and measure response time Internet 4 Passed Request Blocked Request 3. Analyse response time

7 Introduction: Web Application Firewalls Demilitarized Zone Intranet Web Server Internet Passed Request Blocked Request 5

8 Introduction: Web Application Firewalls Internet Demilitarized Zone Intranet Web Server 6

9 Introduction: Web Application Firewalls Internet Demilitarized Zone Intranet Web Server 7

10 WAFfle: Results Internet Demilitarized Zone Intranet Web Server mod_security filtering as web application plugin 8

11 WAFfle: Results Internet Demilitarized Zone Intranet Web Server mod_security filtering as web application plugin 8

12 WAFfle: Results Results All three scenarios allow to distinguish blocked from passed requests by observing response times With no repetitions, >95% of single requests already correctly determine blocked and passed requests 1(a) 1(b) 1(c) 9

response times With no repetitions, >95% of single requests

13 WAFfle: Results Results All three scenarios allow to distinguish blocked from passed requests by observing response times With no repetitions, >95% of single requests already correctly determine blocked and passed requests 1(a) 1(b) 1(c) 9

14 WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) 10

15 WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) Web User 2) Victim Web Application Web Browser 3) WAF 4) Sends Measurements Attacker 1) Visits 10 Web Site

WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) Web

16 WAFfle: Cross Site Timing Attack One more thing... We re on the web, and the web allows cross site requests Extend WAFfle for Cross Site Request Forgery (Cross Site Timing Attack) Generate Javascript code that attacker embeds on web page Web User 2) Victim Web Application Attacker tricks other users to visit web page other users perform measurement and send measurements to attacker 3) Web Browser 4) Sends Measurements Attacker WAF 1) Visits 10 Web Site

Site Timing Attack) Generate Javascript code that attacker embeds on web page Web User 2) Victim Web Application

17 WAFfle: Cross Site Timing Attack Cross Site Timing Attack 11

18 Thanks! Discussion. 12

WAFFle: Fingerprinting Filter Rules of Web Application Firewalls

Email: [email protected] Twitter: @seecurity WAFFle: Fingerprinting Filter Rules of Web Application Firewalls Isabell Schmitt, Sebastian Schinzel* Friedrich-Alexander Universität Erlangen-Nürnberg